How to use AES-128 algorithm for software encryption and decryption in S32K1 series?

[ZEROOO]

Hi,

     On S32K118, I am learning to encode AES-128 using CSEc,But I don't know how to use AES-128 for encryption, could you please provide some materials and code demo.

[lyq]

为什么没有答复呢？我也想知道到底怎么使用，为什么官方不重视

[lukaszadrapa]

Hi @ZEROOO 

We have application note AN5401 which includes SW examples:

https://www.nxp.com/webapp/Download?colCode=AN5401&location=null

https://www.nxp.com/webapp/Download?colCode=AN5401SW&location=null

First, it’s necessary to configure the device using 1_Configure_part_and_Load_keys project. Then run 3_Basic_operations which shows how to use the features.

If you use SDK, there are three examples:

c:\NXP\S32DS.3.4\S32DS\software\S32SDK_S32K1XX_RTM_4.0.2\examples\S32K116\driver_examples\system\csec_flash_part\

c:\NXP\S32DS.3.4\S32DS\software\S32SDK_S32K1XX_RTM_4.0.2\examples\S32K116\driver_examples\system\csec_keyconfig\

c:\NXP\S32DS.3.4\S32DS\software\S32SDK_S32K1XX_RTM_4.0.2\examples\S32K116\driver_examples\system\security_pal\

First one is used to partition the device, i.e. enable the CSEc. This is needed to run next two examples.

See please description of the examples in:

c:\NXP\S32DS.3.4\S32DS\software\S32SDK_S32K1XX_RTM_4.0.2\doc\S32SDK_S32K116_UserManual.pdf

And my recommendation - as a first step, read thoroughly whole AN5401 to understand all the steps.

Regards,

Lukas

[ZEROOO]

Hi

    Thank you very much for your information.I want to use AES-128 CMAC algorithm, but there seems to be no clear explanation in the demo. Is there a clear procedure for using AES-128 CMAC algorithm? I am a little confused about the use of AES-128 CMAC, AES-128 ECB and AES-128 CBC.

[lukaszadrapa]

I think that the project 3_Basic_operations from AN5401 is quite clear:

Encryption and decryption:

 CMAC generation and verification:

Regards,

Lukas

[ZEROOO]

Hi

    I would like to ask whether AN5401 just explains the application of S32k1XX Csec module. First of all, we still need to drive the Csec module. Is this driver referred to the example in S32DS

[lukaszadrapa]

Hi @ZEROOO 

the driver in AN5401 and driver in SDK is slightly different. The AN5401 was created sooner than first versions of SDK, so that's the reason.

If you use SDK, you can use AN5401 as an explanation of CSEc features.

Regards,

Lukas

[ZEROOO]

Hi

  Can I understand that the application demo in AN5401 needs to run based on the drivers in the SDK? I just came into contact with the CSec module, and what I want to do is to package the 5 demos in AN5401 into 5 corresponding functions respectively. However, comparing the contents in AN5401 and SDK makes me a little confused. There are three modules in SDK: csec_boot_protection_s32k118, csec_keyconfig_s32k118 and csec_flash_part_s32k118. csec_keyconfig_s32k118 and csec_flash_part_s32k118 should correspond to example 1 and example 2 in AN5401. If I want to use SDK directly, what should I do? Can I port code in AN5401.

[lukaszadrapa · Accepted solution]

Hi,

either use AN5401 code or SDK. I do not recommend to mix it together.

SDK project csec_flash_part_s32k118 erases all the flash and IFR and sets partition with CSEc enabled.

csec_keyconfig_s32k118 project loads MASTER_ECU_KEY, KEY_1 and then it run encryption to test it. If you set macro ERASE_ALL_KEYS to 1 then it runs CMD_DBG_CHAL and CMD_DBG_AUTH commands to erase the keys and to destroy the partition.

So, these two projects are similar to:

1_Configure_part_and_Load_keys

3_Basic_operations (well, here only encryption is tested)

5_Resetting_flash_to_the_factory_state

Regards,

Lukas

[ZEROOO]

[ZEROOO]

Hi

    I ported the 1_Configure_part_and_Load_keys example with the 2_Update_user_keys example and added the flash driver initializer and the Csec driver initializer, but the csec_error value was always 0, indicating an error. At the same time, the CSE_PRAM register has not been accessible. Could you please tell me how to set the initial configuration of the CSEC module and how to solve the above problems.

    Best Wishes!

[ZEROOO]

[ZEROOO]

Hi

    Csec_flash_part_s32k118 was compiled in S32DS to generate ELF and SREC files.Using IC5000 burn, click the run button procedures have not been able to run normally, back onto the csec_keyconfig_s32k118 initFlashForCsecOperation functions, The reset occurs when the discoverer runs to the FLASH_DRV_EraseAllBlock function.

    I would like to ask what should be configured and what should be paid attention to to enable normal debugging of csec_flash_part_s32k118 project. Why the reset occurs when this function is executed? Is it because the program is written debug in flash but not in RAM

    Another problem is that in my debugging process of csec_keyconfig_s32k118 project, the value of keyloaded is always 0, and I cannot enter if. Later, I directly changed the value of keyloaded through ic5000 to enter if condition, but the execution of ecb encryption failed. Is it because my previous flash configuration failed to run, leading to partition configuration failure, and finally load key failure and encryption failure.